📖 What is Pivoting?
Pivoting is the technique of using a compromised system as a gateway to attack other systems within the same network that are not directly accessible from the outside. It allows an attacker to move deeper into a restricted internal network.
"Pivoting often requires configuring a proxy or tunnel on the compromised host to route traffic from the attacker's machine to the internal target."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Pivoting?
- ▸ Proxychains is a critical tool for PenTest+ that allows attackers to route traffic through multiple SOCKS proxies to reach hidden internal targets.
- ▸ SSH Tunneling involves creating encrypted channels—local, remote, or dynamic—to bypass firewall restrictions and access services on an internal network segment.
- ▸ Dual-homed hosts are systems with multiple network interfaces, acting as the essential bridge that enables an attacker to pivot between different network zones.
- ▸ Port Forwarding redirects traffic from a specific port on the compromised pivot host to a target port on another machine within the internal network.
- ▸ Pivoting is the technical mechanism that enables lateral movement, allowing an attacker to expand their reach from a single entry point to the rest of the network.
🎯 How does Pivoting appear on the PT0-002 Exam?
You may be asked to identify the correct tool or technique when you have gained a shell on a web server and need to scan a database server located on a separate, restricted internal subnet.
A scenario might describe a target environment with a dual-homed host; expect questions on how to configure a SOCKS proxy to route traffic from your attack machine to the internal network.
Expect questions regarding the choice between local and remote port forwarding when the goal is to expose a specific internal service to your external attacker machine for exploitation.
❓ Frequently Asked Questions
What is the difference between pivoting and lateral movement?
Lateral movement is the strategic goal of moving through a network to find high-value targets. Pivoting is the specific technical method of using a compromised host as a relay to access those targets.
When should I use a SOCKS proxy versus simple port forwarding?
Use port forwarding for a single specific service, such as RDP. Use a SOCKS proxy when you need to route various tools, like Nmap or a web browser, through the pivot host.